- Newest
- Most votes
- Most comments
I would look at cloud trail to see what’s stopping the instances. This should help pinpoint the source.
It sounds like there is an EventBridge rule either triggering on an event or a schedule.
Go to CloudTrail >> Event History then select "Lookup attributes" as "Event name" and in search bar type "StopInstance" and then select the date/time filter for as per the time when this has last occurred. Then within logs you can get more information about where/why this is happening. This information would be crucial for further investigation. Similar thing can be done for RDS instance. You can type "StopDBInstance". Also, check if you have any budget automation which is causing the forced stop of resources.
Hello.
Does this mean that EC2 and RDS will automatically stop?
Or does this mean that I will no longer be able to connect to applications hosted on EC2?
If you are unable to access an application hosted on EC2, it may be due to insufficient EC2 specifications.
If EC2 and RDS stop automatically, some AWS API is probably being executed.
Therefore, I recommend that you identify the API that is stopping EC2 or RDS from CloudTrail and identify who is running it.
In the case of EC2, I think the "StopInstances" API or similar is being executed.
In the case of RDS, I think the "StopDBInstance" API or similar is being executed.
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/tutorial-event-history.html
There are no APIs running. I tried starting the database on it's own an it just shuts down as soon as it comes up. The same happened when I tried an EC2 instance on its own.
Like I said, this was all working fine a few hours ago.
Normally, when you stop EC2 or RDS, an API event is recorded in CloudTrail. There may be some restrictions on the AWS side, so I recommend opening a case with AWS Support under "Account and billing" to inquire. "Account and billing" inquiries are free of charge. https://console.aws.amazon.com/support
I suspect you have a Config rule and your application is following the rules as per Config and hence getting shut down.
There are no config rules set up in this account.
If Auto Shutdown is not enabled, check the AWS Health Dashboard for any ongoing outages. Then review the AWS EC2 and RDS instance events and status for abnormalities. Next, examine the CloudTrail logs to identify which API call is triggering the shutdown. In CloudTrail Event History, filter using the following event names:
Ec2 StopInstances TerminateInstances RebootInstances StartInstances ModifyInstanceAttribute
RDS StopDBInstance RebootDBInstance DeleteDBInstance ModifyDBInstance StartDBInstance
Ref: https://repost.aws/knowledge-center/cloudtrail-search-api-calls
answered 9 months ago
Hi,
If your EC2-based application with an RDS database starts normally but then all services shut down a few minutes later, it usually indicates one of a few common issues.
First, check whether AWS had any disruptions in your Region. The AWS Health Dashboard and the “Events” sections in EC2 and RDS will show if there were unexpected reboots, failovers, or maintenance actions. An RDS reboot or failover can cause all services to stop at once if the app loses its DB connection.
If there are no AWS issues, the most likely cause is internal automation. EventBridge rules, Systems Manager Automation/State Manager, Auto Scaling scheduled actions, or ECS configurations may be stopping the instance or scaling your services down shortly after startup.
Another possibility is that the EC2 instance itself is shutting down services due to resource problems—such as memory exhaustion, disk issues, or a system-level shutdown script (cron, systemd timer, etc.). Checking system logs for OOM or shutdown messages will confirm this.
Finally, if the RDS connection drops after a few minutes because of recent security group or network ACL changes, the application may shut itself down when it can no longer reach the database.
Checking these four areas—AWS events, automation, EC2 logs, and RDS connectivity—will usually identify the root cause. If you can share log snippets or Region details, I can help narrow it down further. If this answer helped, please consider accepting it as the solution. It would be greatly appreciated.
Thx.
answered 9 months ago

The issue seems to have stopped happening now.